As you can see, even without bootnodes, geth is trying to discover. Now the question is, I am not understanding something in the protocol or are there some undocumented features in geth in the sources? Because, if there are no bootnodes , it shouldn't be able to find anything, right? Or does it starts to scan the internet randomly expecting to find some Ethereum node?

I know about nodiscover flag, but with bootnodes disabled the algorithm for discovery shouldn't work. This is what I am not understanding, how does it run discovery algorithm without bootnodes.
– NulikOct 8 '17 at 23:39

I'd look into p2p/server.go, my guess is it that either geth has a database with previous session nodes, or an external node has your ip, and it is trying to communicate using the p2p protocol.
– IsmaelOct 9 '17 at 3:13

I just moved into a hotel right now (so my ip address is different), removed all in the datadir, started geth process and my tcpdump console goes like crazy with requests to 30303. I don't know what it does but the traffic looks pretty heavy. My bet is that it is scanning the whole internet.
– NulikOct 9 '17 at 11:41

I've had the same issue. It appears that --nodiscover is just disabling your node from running node-discovering algorithm to find peers to connect, but it doesn't prevent others from discovering and attempting to connect to your node. If you'd like to limit the inbound connection attempts, you could specify --netrestrict.
e.g. --netrestrict="127.0.0.1/8"